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Dear Sir/Madam, 
CONSULTATION ON THE DRAFT RIGHT OF ACCESS GUIDANCE 


I wish to respond to the Information Commissioner’s consultation on behalf of the 
Conservative Party, commenting on certain areas of the draft guidance. 


Definition of excessive 


Page 36 of the draft guidance seeks to interpret Section 53 of the Data Protection Act 2018 in 
defining what is an ‘excessive’ request. The draft guidance states: “It is not necessarily 
excessive just because the individual: requested a large amount of information”. 


This is a significant change in practice than the norm adopted by organisations across the 
country, including by government bodies. For example, I am aware that current Cabinet Office 
guidance states: “Requests can also be considered for refusal on this basis if the requestor is 
asking for very substantial volumes of information.” 


The draft guidance is an excessively narrow interpretation of what Section 53 of the Data 
Protection Act 2018 says: “(2) An example of a request that may be excessive is one that merely 
repeats the substance of previous requests.” 


This is an example — it is not exclusive. Such illustrative wording allows for other examples of 
what is excessive. Any reasonable interpretation of the word ‘excessive’ is something that is 
exceedingly voluminous. We believe this guidance is consequently an error in law, and the 
definition of excessive should include asking for very substantive volumes of information. Of 
course, this would not prevent the applicant then seeking to narrow their request. Indeed, this 
is the principle by which the Freedom of Information Act works. 


The effect of this interpretation in the draft guidance would be to impose significant burdens 
on the public sector, private sector and voluntary sector organisations, by forcing them to 
process requests which are exceedingly voluminous. I note that no impact assessment has been 
produced by the ICO on this guidance. 
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Requests channelled through third party portals and bulk requests 


We are supportive of the position on page 12 and 22 in relation to the use of third party portals, 
and bulk requests. 


Political parties in particular face challenges during election periods. This is at a time when 
political parties are subject to extremely tight compliance requirements across electoral law, 
and indeed, information and data protection law, and when ‘business activity’ is at its most 
intensive. The compliance burdens would become extremely difficult to meet in face of 
organised voluminous requests in such a compressed period. This matter affects all political 
parties, not just the Conservative Party. 


We would suggest that the two sections should be cross-linked: if third party portals or third 
party campaigns are systematically soliciting a large volume of requests (such as using social 
media to drive traffic to portals to make requests), then this should be taken into account by the 
ICO. 


The solicitation of bulk requests may in itself constitute evidence of manifestly unfounded 
and/or excessive behaviour; in that context, it would benefit a read-across to page 35-36 of the 
guidance. 


Retention of data 


Page 7 of the guidance recommends that a log is maintained of such requests. It is not clear 
how long such logs (and associated data — such as emails with the applicant, and proof of ID) 
should be maintained for, in light of the data minimisation principle. 


It is particularly pertinent when an organisation may be winding down (for example, at the end 
of a political campaign), but incoming access requests are made. The organisation will rightly 
wish to shut down its operations, and delete data that should no longer be retained. Some 
guidance on these issues would be beneficial. l 


Length of guidance 


The accompanying questionnaire to the consultation asks about the length of the guidance. We 
would note that it is very long at 77 pages. The ICO’s draft code for direct marketing also out 
for consultation is 123 pages. The ICO’s draft framework code of practice for the use of 
personal data in political campaigning is 97 pages. We would politely observe that this trend 
of voluminous guidance will in itself create new compliance burdens and costs, 


We hope these points will be useful. 
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